Workbench Cookie Notice

Current storage choices

Essential storage and optional analytics

Workbench uses essential cookies and browser storage to provide and secure the Service. If you accept Usage analytics, it also uses optional browser storage to recognize repeat visits and understand product usage with PostHog. Optional analytics does not start before you agree. Choose Reject all to continue with essential technologies only. No ad-network cookies, cross-site tracking, behavioral-advertising pixels, or session replay are enabled.

The workbench-analytics-consent-v1 local-storage entry save your selected categories, notice version and choice time for up to 180 days. If a sign-in callback clears browser storage, Workbench asks for a fresh choice; cookies cannot enable scripts or analytics by themselves. Saving this preference does not itself send an analytics event. After you agree, workbench-analytics-visitor-v1 stores a random browser identifier in local storage, and workbench-analytics-session-v1 stores an analytics session identifier and last-activity time in session storage. A new analytics session begins after 30 minutes without a tracked page visit or when the browser session ends. We do not load a PostHog browser script. A secure, host-only __Host-workbench-analytics-v2 cookie records your accepted analytics choice for conversion attribution. It cannot enable analytics or third-party scripts by itself; sign-in storage clearing requires fresh acceptance. It expires with your choice, after at most 180 days; it may also hold the fixed paid-search campaign code for up to 30 days. It contains no account or browser identifier. workbench-analytics-completion-v2 entries prevent repeat milestone submissions and contain a pseudonymous account reference and milestone name. Withdrawal removes these entries and the cookie from accessible storage. Signing out clears the cookie.

Use Privacy preferences, including on this page, to change your choice. Withdrawal stops new collection and removes these analytics identifiers from accessible storage; essential sign-in and workspace records remain separate. Identifiers otherwise remain until storage is cleared or a later visit detects withdrawal, an expired choice, or a privacy signal. Global Privacy Control and Do Not Track keep optional analytics off. If browser storage is unavailable or we cannot save a choice, optional collection remains off. A storage failure can prevent a choice from persisting; clear site storage in your browser to remove a previously saved choice. The Privacy Notice explains the information sent to PostHog, provider handling and privacy requests.

Google authentication and optional security services

Google sign-in stays visible and available even if you reject optional cookies or make no optional-cookie choice. Workbench contacts Google Identity Services only after you click Continue with Google. Google receives ordinary network information when its authentication script and account chooser load, and provides your verified identity to sign you in. This action requests Google authentication only; it does not save or change your optional-services or Usage analytics preferences. If your browser suppresses the account prompt, use the Google button that appears to continue. Essential authentication storage is separate from optional analytics.

Cloudflare Turnstile scripts stay off until you explicitly accept Security services. Cloudflare provides the required security check when enabled for email sign-in and account creation. It receives ordinary network information when its scripts and widgets load. Refusing this category keeps that security widget unavailable; it does not bypass the security check. Accepting this category does not accept Usage analytics and never loads Google by itself. Accepting Usage analytics never loads Google or Cloudflare scripts.

Accept all enables the available categories, subject to your browser privacy signals for analytics. Choose lets you select categories and click Accept selected; checkboxes alone do not grant permission. Reject all disables both categories. Privacy preferences lets you change or withdraw your choice on any page. When you withdraw script permission, Workbench reloads after saving your choice to unload the running provider code. Invalid, expired, unsaved, or superseded choices keep optional services off. The public HardwareHub website keeps its own separate consent choice.

What the essential technologies do

• Authentication and session security: keep you signed in, protect the session, and support account verification and recovery.
• Request and abuse protection: help prevent cross-site request forgery, replay, automated abuse, and excessive requests.
• Continuity and preferences: remember the selected workspace or project, interface preferences, unsent drafts, and opaque request or session identifiers needed to complete an action. Workbench does not intentionally retain complete conversation bodies in browser storage after signout or an account change.
• CAPTCHA: Cloudflare Turnstile may use necessary browser and device signals when public account creation is enabled.
• Billing: Stripe may use necessary cookies and browser storage on its hosted checkout and customer-portal pages.
• Hosting and delivery: Vercel and Supabase receive ordinary request and security data needed to deliver and protect the Service.

How long first-party storage lasts

• Access continuity: up to 15 minutes.
• Selected workspace and scope: up to 30 days.
• Timezone and timezone source: up to one year.
• Authentication: for the authenticated session lifetime, subject to the authentication provider's security and refresh controls.
• Session storage: ordinarily until the browser tab or session ends.
• Local storage: until the preference, unsent draft, or continuity record is replaced, signout or account change removes content-bearing HardwareHub records, or the user clears browser storage. Workbench removes obsolete records when the relevant workflow supports it.

Turnstile, Stripe, Google sign-in, Supabase, and Vercel may use necessary cookies or device signals under their own notices when the corresponding feature is enabled. HardwareHub does not authorize those providers to use Workbench User Content for advertising.

Your controls

Browser controls can remove or block cookies and storage, but essential features may then stop working. Optional analytics follows the choice and browser-signal controls described above.

Questions or requests: privacy@hardwarehub.io.